NASM 2.05 based x86 Instruction Reference[ch296]
A.5.272 RDSHR: Read SMM Header Pointer Register RDSHR r/m32 ; 0F 36 /0 [386,CYRIX,SMM] RDSHR reads the contents of the SMM header pointer register and saves it to the destination operand, which can be either a 32 bit memory location or a 32 bit register. See also WRSHR (section A.5.330).